@apmantza/greedysearch-pi: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@apmantza/greedysearch-pi: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

test.mjsView file

13L14: import { spawn } from "node:child_process"; L15: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

test.mjsView on unpkg · L13

13Cross-file remote execution chain: test.mjs spawns bin/cdp.mjs; helper contains network access plus dynamic code execution. L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L76: err = ""; L77: proc.stdout.on("data", (d) => (out += d)); L78: proc.stderr.on("data", (d) => (err += d)); ... L85: try { L86: const data = JSON.parse(readFileSync(file, "utf8")); L87: return checkFn(data); ... L328: else failMsg("synthesizer: gpt alias should normalize to chatgpt"); L329: if (getSynthesisStartUrl("chatgpt") === "https://chatgpt.com/") L330: passMsg("synthesizer: chatgpt start URL");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

test.mjsView on unpkg · L13

src/utils/system-cmds.mjsView file

16* L17: * @param {string} cmd - Command name (e.g. "netstat", "powershell") L18: * @returns {string} Absolute path or bare command name as fallback

High

Shell

Package source references shell execution.

src/utils/system-cmds.mjsView on unpkg · L16

scripts/run-tests.ps1View file

•path = scripts/run-tests.ps1 kind = build_helper sizeBytes = 6276 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-tests.ps1View on unpkg

extractors/common.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apmantza/greedysearch-pi@2.1.4 matchedIdentity = npm:[redacted]:2.1.4 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extractors/common.mjsView on unpkg

Source & flagged code

5 flagged

test.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// test.mjs — Cross-platform test runner for GreedySearch (Windows + Unix)

3//

4// Usage:

5// node test.mjs # run all tests (~8-12 min)

6// node test.mjs quick # skip slow tests (~3 min)

7// node test.mjs smoke # basic health check (~60s)

8// node test.mjs parallel # race condition tests only

9// node test.mjs flags # flag/option tests only

10// node test.mjs edge # edge case tests only

11// node test.mjs unit # fast unit tests only (no Chrome needed)

12// node test.mjs synth # synthesis config smoke (gemini + chatgpt)

13

14import { spawn } from "node:child_process";

15import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

test.mjsView on unpkg · L13

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

test.mjsView on unpkg · L13

16import { dirname, join } from "node:path";

17import { fileURLToPath } from "node:url";

18

19const __dir = dirname(fileURLToPath(import.meta.url));

20

21// ANSI colors

22const C = {

23 red: "\x1b[31m",

24 green: "\x1b[32m",

25 yellow: "\x1b[33m",

26 blue: "\x1b[34m",

27 cyan: "\x1b[36m",

28 reset: "\x1b[0m",

29};

30

31const mode = process.argv[2] || "all";

32const resultsDir = join(__dir, "results", `test_${Date.now()}`);

33mkdirSync(resultsDir, { recursive: true });

src/utils/system-cmds.mjsView file

Lines 1-36javascript

1// src/utils/system-cmds.mjs — Resolve system utilities to absolute paths

2//

3// Using absolute paths for system commands prevents PATH-injection risks

4// and satisfies SonarCloud security hotspot requirements.

5

6import { execSync } from "node:child_process";

7import { existsSync } from "node:fs";

scripts/run-tests.ps1View file

•path = scripts/run-tests.ps1 kind = build_helper sizeBytes = 6276 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-tests.ps1View on unpkg

extractors/common.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @apmantza/greedysearch-pi@2.1.4 matchedIdentity = npm:[redacted]:2.1.4 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extractors/common.mjsView on unpkg